Drupal patches critical RCEs CVE-2026-108097 and CVE-2026-108099
Original title: Drupal Patches Critical RCEs: CVE-2026-108097 & 108099
The captured page gives no affected versions, fixed releases, or statement on exploitation.
A SOCRadar headline says Drupal patched critical remote code execution flaws tracked as CVE-2026-108097 and CVE-2026-108099. The supplied text is site navigation and marketing and does not describe either bug, affected releases, or whether attackers are exploiting them. No remediation details beyond the headline's claim that patches exist are available here.
Unconfirmed: Only the headline is available; vulnerability details, versions, and exploitation status are not in the text.
- The item body contains no technical description of either CVE.
- No affected Drupal versions or fixed release numbers are stated.
Impact: Remote code execution, per the headline
| Product | Affected |
|---|---|
| Drupal | — |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-108097 | — | — | PoC ×2 | — | |
| CVE-2026-108099 | — | — | — |
From the original article
11 min read at socradar.io
Drupal has patched two critical remote code execution (RCE) vulnerabilities affecting Drupal core and the contributed Entity List module. The first flaw, tracked CVE-2026-108097, affects the core Field UI module, while CVE-2026-108099 affects Entity List. Neither is directly exploitable through the affected component alone, but Drupal warns that multiple serious exploit paths exist through contributed […]
By Ameer Owda · socradar.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.